NEXIOS REAL ESTATE PROJECT FINANCE — DATA PROCESSING AGREEMENT Version 2026-11-14 This Data Processing Agreement ("DPA") supplements and is incorporated into the Terms of Service between Norman Fuchs, doing business as Nexios ("Nexios", "we", "us", "Processor"), and the institution identified at account creation ("you", "your", "Controller"), and governs Nexios's processing of Your Data (as defined in the Terms of Service) that includes personal information. Capitalized terms not defined here have the meaning given in the Terms of Service. This DPA is subject in full to the Terms of Service's limitation of liability (Terms §12); nothing in this DPA creates liability broader than, or in addition to, what that section already caps. 1. ROLES OF THE PARTIES You are the Controller (or, under frameworks that use the term, the "Business") with respect to Your Data. Nexios is the Processor (or "Service Provider"), acting only on your documented instructions as set out in the Terms of Service and this DPA, and not for any independent purpose of its own. 2. NATURE, PURPOSE, AND DURATION OF PROCESSING Nexios processes Your Data solely to provide, secure, support, and maintain the Service for the duration of your subscription, and for the limited post-termination export/retention period described in Terms of Service §9. 3. CATEGORIES OF DATA AND DATA SUBJECTS Categories of data: loan, project, parcel, instrument, syndication, draw, covenant, document, and borrower-submission records you enter into the Service; account identifiers and role assignments for your own staff; and, where you choose to enter it, personal information about borrower principals or guarantors named in a borrower submission or related document. Categories of data subjects: your institution's own staff users of the Service, and, where applicable, borrower principals, guarantors, or other individuals named in data you submit. 4. SUBPROCESSORS You authorize Nexios to engage the subprocessors listed in the Privacy Policy's Subprocessors section (currently: database hosting, application hosting, payment processing, and, only when the optional AI assistant is used, the AI provider), each limited to the function described there. Nexios will: (a) impose data-protection obligations on each subprocessor no less protective than this DPA with respect to the data that subprocessor can access; (b) remain responsible for each subprocessor's performance of those obligations; and (c) give you reasonable advance notice before engaging a new subprocessor that would process Your Data, during which you may object on reasonable data-protection grounds, in which case the parties will work in good faith toward a resolution (which may include disabling the specific feature that relies on that subprocessor, such as the AI assistant). 5. SECURITY MEASURES Nexios implements the technical and organizational measures described in the Security Overview (GET /api/saas/platform/security), including a dedicated, fully separate database per institution, encryption of sensitive control-plane secrets at rest, encryption of data in transit, role-based access control, maker-checker segregation of duties on draw approvals, and bcrypt password hashing. Nexios will review and update these measures as the Service evolves, and will not materially reduce their overall level of protection during your subscription term without reasonable notice. 6. PERSONNEL Nexios limits access to Your Data to the personnel who need it to provide the Service, and requires them to be bound by confidentiality obligations at least as protective as this DPA. 7. ASSISTANCE WITH YOUR OBLIGATIONS Taking into account the nature of the processing, Nexios will provide reasonable assistance to help you respond to a data subject's request to exercise their rights (such as access, correction, or deletion) and to meet your own regulatory notification obligations, to the extent such assistance is within Nexios's control and does not require Nexios to take on obligations beyond those in this DPA. 8. SECURITY INCIDENT NOTIFICATION If Nexios becomes aware of a confirmed unauthorized access to or disclosure of Your Data (a "Security Incident"), Nexios will notify you without undue delay, and in any event within seventy-two (72) hours of confirming the Security Incident, with the information then available, including the nature of the incident, the categories and approximate volume of data affected, and the remediation steps taken or planned. Nexios will reasonably cooperate with your own investigation and any regulatory notification you are required to make. 9. AUDIT AND REVIEW On reasonable advance written request, no more than once per twelve-month period absent a Security Incident, Nexios will: (a) provide a current copy of the Security Overview and respond in good faith to a reasonable written security questionnaire; and (b) discuss and, where commercially reasonable, accommodate a request for additional assurance (such as a more detailed walkthrough of a specific control). Nexios does not currently hold a formal third-party security certification (such as SOC 2 or ISO 27001); the Security Overview is Nexios's current, good-faith factual description of its actual architecture and controls, offered in place of a certification at this stage. A full on-site or third-party audit is not provided by default under this DPA and would need to be separately negotiated and scoped (including as to cost), reflecting the realistic limits of what a sole-proprietor-operated service can support for every customer on demand. 10. RETURN AND DELETION OF DATA On termination of your subscription, Nexios will handle Your Data as described in Terms of Service §9 (a reasonable export period followed by deletion, including deletion of your institution's dedicated database), except where a longer retention period is required by law or necessary to resolve disputes or enforce the parties' agreements. 11. INTERNATIONAL TRANSFERS Your Data is processed and stored in the United States. If a future subprocessor would process Your Data outside the United States, Nexios will provide notice under §4 before doing so, so you can assess whether that is acceptable for your institution's own regulatory obligations. 12. LIABILITY This DPA does not expand, and remains fully subject to, the limitation of liability in Terms of Service §12. 13. GOVERNING LAW This DPA is governed by the same governing law and venue as the Terms of Service (§14). 14. TERM This DPA remains in effect for as long as Nexios processes Your Data on your behalf under the Terms of Service, and survives termination to the extent necessary to give effect to §§8, 10, and 12. Questions about this DPA can be sent to sales@polyapps-ai.com.